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Abstract 

We give a deterministic algorithm for solving the (1 + e) approximate Closest Vector Problem (CVP) 
on any n dimensional lattice and any norm in 2°W(1 + l/e)" time and 2™poly(n) space. Our algo- 
rithm builds on the lattice point enumeration techniques of Micciancio and Voulgaris (STOC 2010) and 
Dadush, Peikert and Vempala (FOCS 201 1), and gives an elegant, deterministic alternative to the "AKS 
Sieve" based algorithms for (1 + e)-CVP (Ajtai, Kumar, and Sivakumar; STOC 2001 and CCC 2002). 
Furthermore, assuming the existence of a poly(n)-space and 2°( n ' time algorithm for exact CVP in the 
I2 norm, the space complexity of our algorithm can be reduced to polynomial. 

Our main technical contribution is a method for "sparsifying" any input lattice while approximately 
maintaining its metric structure. To this end, we employ the idea of random sublattice restrictions, 
which was first employed by Khot (FOCS 2003) for the purpose of proving hardness for Shortest Vector 
Problem (SVP) under l p norms. 
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1 Introduction 



An n-dimensional lattice C is {J^ILi z ^°i '■ Zi £ Z,i G [n]} for some basis bi,. . . ,b n of M n . Given a 
lattice £ and norm || • || in 1", the Shortest Vector Problem (SVP) is to find a shortest nonzero v € £ under 
|| • || . Given an additional target t G R n , the Closest Vector Problem (CVP) - the inhomogenous analog 
of SVP - is to find a closest v G £ to t. Here, one often works with the £2 norm and other £ v norms, or 
most generally, with norms (possibly asymmetric) induced by a convex body K containing in its interior, 
defined by \\x\\k = inf{s > : x € sK}. 

The SVP and CVP on lattices are central algorithmic problems in the geometry of numbers, with appli- 
cations to Integer Programming [Len83 1, factoring polynomials over the rationals HLLL821 . cryptoanalysis 
(e.g., HOdl901 IJS981 INS01I ). and much more. For different applications, one must often consider lattice 
problems expressed under a variety of norms. Decoding signals over a Gaussian channel is expressed as a 
CVP under £2 HVB991 , computing simultaneous diophantine approximations is generally expressed as an 
SVP under 1^ (FT87], Schnorr reduced factoring (under some unproven number theoretic assumptions) to 
an SVP under the l\ norm [Sch91 ], the Frobenius problem can be expressed as a lattice problem under an 
asymmetric simplicial norm [Kan92], the Integer Programming problem reduces to lattice problems under 
general norms HKan871lDPV1111 . etc. 

Much is known about the computational complexity of SVP and CVP, in both their exact and approx- 
imation versions. On the negative side, SVP is NP-hard (in £2, under randomized reductions) to solve 
exactly, or even to approximate to within any constant factor | |Ajt98| ICN981 IMic981 IKho04ll . Many more 
hardness results are known for other l v norms and under stronger complexity assumptions than P 7^ NP 
(see, e.g., HvEB 8 1 1 IDInOOl IRR061 IHROTI ) . CVP is NP-hard to approximate to within n c/loglogn factors for 
some constant c > [ABSS93, DKRS98, DinOO], where n is the dimension of the lattice. Therefore, we 
do not expect to solve (or even closely approximate) these problems efficiently in high dimensions. Still, 
algorithms providing weak approximations or having super-polynomial running times are the foundations 
for the many applications mentioned above. 

Though the applications are often expressed using a variety of norms, the majority of the algorithmic 
work on SVP and CVP over the last quarter century has focused on the important case of the £2 norm. While 
there has been both tremendous practical and theoretical progress for £2 based solvers, progress on more 
general norms has been much slower (we overview this history below). Illustrative of this, for most of the 
problems mentioned above, the solution strategy has almost invariably been to approximate the problem via 
a reduction to £2. In many cases, the desired computational problem requires only a "coarse" approximate 
solution to the underlying lattice problem (e.g. where a poly(n) or even 2°^> factor approximation suffices), 
in which case approximation by £2 is often sufficient. In some cases however, the errors induced by the 
£2 approximation can result in a substantial increase in worst case running time or yield unusable results. 
As an example, with respect to the Integer Programming Problem (IP), in a sequence of works Dadush, 
Peikert and Vempala [DPV11, Dad 12a] worked directly with norms induced by the continuous relaxation 
- avoiding direct ellipsoidal approximations - to reduce the complexity of solving an n-variable IP from 
2°( n )n 2 " (previous best using £2 techniques IIHK10I ) to 2°( n )n n . From these considerations we see that the 
problem of developing effective algorithms for solving the SVP and CVP under general norms is motivated. 

The algorithmic history of the SVP and CVP is long and rich. We relate the broad outlines here, 
highlighting the pertinent developments for general norms, and refer the reader to the following refer- 
ences [M G02[|HPS11I for a more complete accounting. There are three main classes of methods for solving 
lattice problems: basis reduction, randomized sieving, and Voronoi cell based search. 

Basis reduction combines both local search on lattice bases and lattice point enumeration. The cel- 
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ebrated LLL basis reduction algorithm HLLL821 and further extensions HBab851 ISch87H give 2 n /^ {o ^ 
approximations to SVP and CVP under £2 in poly(n) time. General norm variants of basis reduction are 
explored in [LS92] IKR951 and give similar approximation guarantees for SVP (though not CVP) as the £2 
versions. However, bounds on the time complexity were only proved for fixed dimension (when the running 
time is polynomial). For exact SVP and CVP in the £2 norm, Kannan's algorithm and its subsequent im- 
provements [Kan87, Hel85l IHS07B use basis reduction techniques to deterministically compute solutions in 
2°( nI °s") time and poly(n) space. 

This performance remained essentially unchallenged until the breakthrough randomized "sieving" al- 
gorithm of Ajtai, Kumar, and Sivakumar [AKS01], which gave a 2°( n )-time and -space randomized al- 
gorithm for exact SVP under 1%. The randomized sieving approach consists of sampling an exponential 
number of "perturbed" lattice points, and then iteratively clustering and combining them to give shorter 
and shorter lattice points. Subsequently, the randomized sieve was greatly extended to yield solutions for 
more general norms and for the more general problem of (1 + e)-CVP. For exact SVP, the randomized sieve 
was extended (in the same time complexity) to £ v norms [BN07], arbitrary symmetric norms [AJ08 1, and 
to "near-symmetric" Q norms MDadl2b11 . For CVP, the randomized sieve was further used to give a (^) n - 
time and -space algorithm for (1 + e)-CVP under the £ 2 norm HAKS021 IBNOTI . £ p norms HBN071 . and 
near-symmetric norms [Dadl2b|. We remark that near-symmetric norms appear naturally in the context of 
Integer Programming: the problem of finding a lattice point near the "center" of the continuous relaxation 
(which need not be symmetric) can be directly expressed as a CVP under a near-symmetric norm HDadl2bl . 
Lastly, for the specific case of i^, Eisenbrand, Hahnle and Niemeier [EHN1 1] show that (1 + e)-CVP under 
£oo can be solved using 0(ln calls to any 2-approximate solver via an elegant cube covering technique. 
It is worth noting that AKS sieve based algorithms are Monte Carlo: while they output correct solutions 
(i.e. a shortest or closest vectors) with high probability, the correctness is not guaranteed. 

In a major breakthrough, Micciancio and Voulgaris [MV10| gave a deterministic 2°( n )-time and -space 
algorithm for exact SVP and CVP under the £2 norm using the Voronoi cell of a lattice. The Voronoi 
cell, the symmetric polytope consisting of all points in space closer to the origin (under £2) than any other 
lattice point, is represented algorithmically here by 0(2") lattice points corresponding to the facets of the 
Voronoi cell (known as Voronoi relevant vectors). The relevant vectors form an "extended basis" for the 
lattice which Micciancio and Voulgaris (MV) use to efficiently guide closest lattice point search. Though it 
is tempting to try and directly extend the MV techniques to other norms this appears to be quite challenging. 
A major difficulty is that for general norms the Voronoi cell need not be convex, and furthermore no good 
bounds are known for the number of relevant vectors. In a subsequent work however, Dadush, Peikert and 
Vempala BDPV111 showed that MV lattice point search techniques can, in a qualified sense, be extended to 
general norms (in fact, to general convex bodies) via a direct reduction to £2. Combining a technique for con- 
structing "efficient" ellipsoid coverings - using the M-Ellipsoid concept from convex geometiy - together 
with Voronoi cell based search, they showed that the lattice points inside a convex body can be computed 
in time proportional to the maximum number of lattice points the body can contain in any translation. With 
some further improvements [DV12 Dadl2a|, the DPV lattice point enumeration technique was used to give 
the first deterministic 2°( n )-time and -space algorithms for SVP and Bounded Distance Decoding (BDD)| 
under near-symmetric norms. 

Despite all the recent progress, the only algorithms currently available for solving (l+e)-CVP under non- 
euclidean norms remain the AKS sieve based approaches. In this light, a main open problem from [D PV11II 
was to understand whether the DPV lattice point enumeration approach could be extended to work for 

'An asymmetric norm with unit ball K C R n is near-symmetric if vo\„(K) < 2°^ n ' vo\ n (K n —K), 

2 BDD is CVP when the distance to the target is guaranteed to be at most some factor times the minimum distance of the lattice. 
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(1 + e)-CVP under general norms. 

1.1 Results and Techniques 

Our main result is as follows: 

Theorem 1.1 (Approximate CVP in any norm, informal). There is a deterministic algorithm that, given any 
near- symmetric norm \\ ■ \\k, n dimensional lattice C, target x 6 W 1 , and < e < 1, computes y € C, a 
(1 + e)-approximate minimizer to ||y — x||^, in (1 + ^) n • 2°^ time and 0(2 n ) space. 

In the above theorem we extend the DPV lattice point enumeration techniques and give the first determin- 
istic alternative to the AKS randomized sieving approach. Compared to AKS, our approach also achieves 
a better dependence on e, 2°W(1 + instead of 2°( n \l + \) 2n , and utilizes significantly less space, 
0(2 n ) compared to 2°( n )(l + ±) n . Additionally, as we will discuss below, continued progress on exact 
CVP under £2 could further reduce the space usage of the algorithm. We note however that the 2°^ factors 
in the running time are currently much larger than in AKS, though little effort has been spent in trying to 
compute or optimize them. To explain our approach, we first present the main DPV enumeration algorithm 
in its most recent formulation [Dadl2a|. 

Theorem 1.2 (Enumeration in Convex Bodies, informal). There is a deterministic algorithm that, given an 
n-dimensional convex body K and lattice C, enumerates the elements ofK (~l C in time 2°^G(K, C) using 
0(2 n ) space, where G(K,C) = max xg iRn \ (K + x) n C\. Furthermore, given an algorithm that solves 
exact CVP under £2 in T{n) time and S(n) space, K n C can be enumerated in 2°^T(n)G(K, C) time 
using S(n) + poly(n) space. 

The main idea for the above algorithm is to first compute a covering of K by 2°( n ) translates of an 
M-ellipsoid E of K El and to use the MV enumeration techniques to compute the lattice points inside 
each translate of E. In its first incarnation HDPV11II . the above algorithm was randomized - here ran- 
domization was needed to construct the M-Ellipsoid - and had space complexity dependent on G{K,C). 
In MDV1211 . a deterministic M-Ellipsoid construction was presented yielding a completely deterministic enu- 
merator. Lastly in HDadl2al . the space usage was decoupled from G(K,C) and a direct reduction from 
lattice point enumeration to exact CVP under £2 was presented. 

The above lattice point enumerator will form the core of our (1 + e)-CVP algorithm. As we will see 
from the algorithm's analysis, its space usage will only be an additive polynomial factor larger than the space 
required for the enumeration. Therefore, if one could develop an exact CVP solver under £2 which runs in 
2°( n ) time and poly(n) space, then the space usage of our (1 + e)-CVP can be reduced to poly(n) in the 
same time complexity. The possibility of such a solver is discussed in HMV101 and developing it remains 
an important open problem. We remark that by plugging in Kannan's algorithm for CVP under £2, we do 
indeed get a poly(n) space (1 + e)-CVP solver, though at the cost of an n n ' 2 factor increase in running 
time. 

Using the above enumerator as a blackbox, we now present the approach taken in [DPV 11] to solve 
CVP and explain the main problem that arises. Given the target t € W 1 , their algorithm first computes an 
initial coarse underestimate d$ of the distance of t to C under || • \\k (using LLL for example). For the next 
step, they use the lattice point enumerator to successively compute the sets (t + 2 l doK) n £ (i.e. all lattice 
points at distance at most 2 l do from t), i > 0, until a lattice point is found. Finally, the closest vector to t in 
the final enumerated set is returned. 

3 An M-Ellipsoid E of K satisfies that 2°'™' translates of E suffice to cover K and vice versa. 
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From the description, it is relatively straightforward to show that the complexity of the algorithm is 
essentially G(dK, £), where d is the distance of t to £. The main problem with this approach is that, in 
general, one cannot apriori bound G(dK,C); even in 2 dimension this quantity can be made arbitrarily 
large. The only generic setting where such a bound is indeed available is when the distance d of the target is 
bounded by a A, where A is the length of the shortest non-zero vector under j| • \\k. In this situation, we can 
bound G(dK, £) by 2 0<yn \l + a) n . We remark that solving CVP with this type of guarantee corresponds to 
the Bounded Distance Problem problem in the literature, and by a standard reduction can be used to solve 
SVP in general norms as well HGMSS991 . 

To circumvent the above problem, we propose the following simple solution. Instead of solving the CVP 
on the original lattice £, we attempt to solve it on a sparser sublattice £' C £, where the distance of t to £' is 
not much larger than its distance to £ (we settle for an approximate solution here) and where the maximum 
number of lattice points at the new target distance is appropriately bounded. Our main technical contribution 
is to show the existence of such "lattice sparsifiers" and give a deterministic algorithm to compute them: 

Theorem 1.3 (Lattice Sparsifier, informal). There is a deterministic algorithm that, given any near-symmetric 
norm \\ ■ \\k, n dimensional lattice £, and distance t > 0, computes a sublattice £' C £ in deterministic 
20(n) fi me an( j Q(2 n ^j space satisfying: (1) the distance from £' to any point in M. n is at most its distance to 
£ plus an additive t, (2) the number of points in £' at distance t is at most 2°( n \ 

To solve (l+e)-CVP using the above lattice sparsifier is straightforward. We simply compute a sparsifier 
£' for £ under || • \k with t = edx{t, £) (the distance from t to £) , and then solve the exact CVP on 
£' using the DPV algorithm. By the guarantees on the sparsifier, £' contains a point at distance at most 
d + ed = (1 + e)d, and using a simple packing argument (see Lemma |27TT > we can show that 

G((l + e)d,£') = 2° (n) (l + ^) n G{ed,£') = 2°^(1 + ^) n . 

Here we note that the correctness of the output follows from the distance preserving properties of £', and 
the desired runtime follows from the above bound on G((l + e)d, £'). 

To prove the existence of lattice sparsifier's we make use of random sublattice restrictions, a tool first 
employed by Khot [ Kho03, Kho04] for the purpose of proving hardness of SVP. More precisely, we show 
that with constant probability the restriction of £ by a random modular form (for an appropriately chosen 
modulus) yields the desired sparsifier. We remark that our use of sublattice restrictions is somewhat more 
refined than in [ Kho03l fKhoCMH ■ In Khot's setting, the random sublattice is calibrated to remove all short 
vectors on a NO instance, and to keep at least one short vector for a YES instance. In our setting, we 
somehow need both properties simultaneously for the same lattice, i.e. we want to remove many short 
vectors to guarantee reasonable enumeration complexity, while at the same time keeping enough vectors so 
that the original lattice lies "close" to the sublattice. As a final difference, we show that our construction can 
be derandomized in 2°( ra ) time, yielding a completely deterministic algorithm. 

Organization. In section [3j we provide the exact reduction from (1 + e)-CVP to lattice sparsification, 
formalizing Theorem 11.11 In section |4] we prove the existence of lattice sparsifiers using the probabilistic 
method. In section [5j we give the derandomized lattice sparsifier construction, formalizing Theorem 11.31 
Lastly, in section [6l we discuss futher applications and future directions. 
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2 Preliminaries 



Convexity and Norms. For sets A,BC R n , let A + B = {a + b : a <E A,b £ B} denote their Minkowski 
sum. B% denotes the n-dimensional euclidean unit ball in W 1 . A convex body K C W 1 is a full dimensional 
compact, convex set. A convex body K is (ao, r, R) -centered if ao + rB% C K C ao + i^-BJ. F° r 
a convex body if C W 1 containing in its interior, we define the (possibly asymmetric) norm |j • \\k 
induced by K as ||x||_k- = inf{s > : x G sK}. For a (0, r, R) -centered convex body K, we note that 

-r||x|| 2 < \\x\\ K < i||x|| 2 . 

If K is symmetric (K = —K), then || • \\k is also symmetric (||x||jf = || — x||^), and hence defines 
a regular norm on W 1 . The convex body K (|| • \\k) is 7-symmetric for 7 G (0, 1], if vo\ n {K n —K) > 
7™ vol n (iT). K is near-symmetric if it is f2(l)-symmetric. 

Computational Model. The convex bodies and norms will be presented to our algorithms via weak mem- 
bership and distance oracles. For e > and K C W 1 a convex body, we define K £ = K + eB^ and 
K~ e = {x G K : x + ef?2 C K}. A wea^ membership oracle Ok for is a function which takes as input 
a point x G Q n and real e > 0, and returns 0#(x, e) = 1 if x G i^~ £ , if x ^ K £ , and either or 1 if 
x G K e \ K~ e . A weak distance oracle Dk,- for K is a function that takes as input a point x G Q n and 
e > 0, and returns a rational number satisfying |D^ )£ (x) — ||x||x| < e min{l, ||x||jf }. The runtimes of our 
algorithms will be measured by the number of oracle calls and arithmetic operations. For simplicity, we use 
the notation poly(-) to denote a polynomial factor in all the relevant input parameters (dimension, encoding 
length of basis, etc.). 

Lattices. An n-dimensional lattice £ C M" is a discrete subgroup of R n ; £ can be expressed as BZ n , 
where B G R nx " is a non-singular matrix, which we refer to as a basis for C. The dual lattice of L is 
C* = {y G K n : Vx G C (x, y) G Z}, which can be generated by the basis B~ T (inverse transpose). 

We define the length of the shortest non-zero vector of C under || • ||# by Ai (K, C) = mm ye £\ r ) ||y 
We let SVP(K, C) = argmin zg £\{ j ||z||x denote the set of shortest non-zero vectors of £ under || • ||. 
For x G W 1 , define the distance of x to C under || • \\k by dx(£,x) = min yS £ ||y — x||x- We let 
CVP(K, C, x) = argmin yg £ ||y — x||x denote the set of closest vectors to x in L under || • ||^. 

For a lattice L and convex body K in W 1 , let G(K, C) be the largest number of lattice points contained 
in any translate of K, that is G(K, C) = max xe K" | {K + x) fl C\. We will need the following bounds on 
G(K, C) from HDadl2al (we include a proof in the appendix for completeness). 

Lemma 2.1. Let K C R n denote a ^-symmetric convex body and let C denote an n-dimensional lattice. 
Then for d > Owe have that 



Algorithms. We will need the following lattice point enumeration algorithm from HDPVllllDadl2al . 

Theorem 2.2 (Algorithm Lattice-Enum^, C, e)). Let K C W 1 be a (a , r, R)-centered convex body given 
by weak membership oracle Ok, let C C W 1 be an n-dimensional lattice with basis B G Q nxn and let 
e > 0. Then there is a deterministic algorithm that on inputs K,C,e outputs a set S (one element at a time) 
satisfying 




and G{dK,C) <7~ n (2d+l) n - \(Kn-K)n£ 



KC\£QSQ{K + eB%) n C 
in G(K, C) ■ 2°( n ) • poly(-) time using 2 n poly(-) space. 
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We will require the following SVP solver from HDPVllllDadT2al . 

Theorem 2.3 (Algorithm Shortest- Vectors( K, C, e)). Let K C R n be a (ao, r, R)-centered symmetric con- 
vex body given by weak membership oracle Ok, and let C C R™ be an n-dimensional lattice with basis 
B G Q nxn , and let e > 0. Let \\ = \%{K, C). Then there is an algorithm that on inputs K, C, e outputs a 
set S C C satisfying 

SVP(K,£)C5C{ yG £\{0}: \\y\\ K < Ai + emin{l, Ai}} (2.1) 
in deterministic 2°^ poly(-) time and 2 n poly(-) space. 



3 CVP via Lattice Sparsification 

To start, we give a precise definition of the lattice sparsifier. 

Definition 3.1 (Lattice Sparsifier). Let K C R n be a 7-symmetric convex body, C be an n-dimensional 
lattice and t > 0. A (K, t) sparsifier for £ is a sublattice CJ C C satisfying 

1. Vx G M n , d K (C',x) < d K (C,x) + t 

2. G(tK,C) = 2°( n ) 7 - n 

The following theorem represents the formalization of our lattice sparsifier construction. 

Theorem 3.2 (Algorithm Lattice-Sparsifier). Let K C R n be a (0, r, R)-centered and ^-symmetric convex 
body specified by a weak membership oracle Ok, and let C denote an n dimensional lattice with a basis 
B G Q nxn . For t > 0, a (K, t) sparsifier can be constructed for C using 2°^ poly(-) time and 2 n poly(-) 
space. 

The proof of the above theorem is the subject of Sections |4] and [5] (randomized and deterministic con- 
structions, respectively). Using the above lattice sparsifier construction, we present the following simple 
algorithm for (1 + e)-CVP. 

Theorem 3.3. Algorithm\J\(Approx-Closest-Vectors) is correct, and on inputs K,C,x,e (as above), K 
^-symmetric, it runs in deterministic 2 0{ ^^j~~ n {\ + j) n poly(-) time and 2 n poly(-) space. 

Proof. 

Correctness: If x G C, we are clearly done. Next since K is (0, r, ii)-centered, we have that < 
||y|k < ^ for all y G R n . Now take any z G CVP(iT,£,x) and z G SVP(B^,£). Here we note that 
d x = |[z — x||if . As in the algorithm, let I = ■ Now we see that 

llz — xlj llz — xll llz — xll R 

I = 75 — < 75 — < z - x\\k < z - x \\x < = I— 

R R r r 

Therefore / < d x < ly. 

Let df denote the value of d after the first while loop terminates. We claim that ^df < d x < (1 + 
e/3)df +Sq. When the while loop terminates, we are guaranteed that the call to Lattice-Enum((l + ^)dfK + 
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Algorithm 1 Approx-Closest-Vectors(iY~, £, x, e) 

Input: (0, r, i?)-centered convex body if CI" with weak distance oracle Dk for a basis B G Q 

for £, target x G Q n , < e < 1 
Output: Outputs a non-empty set S C {y G £ : ||y — x||^ < (1 + e)dK{£, x)} 
1: if x G £ then return {x} 

2: Compute z G CVP(5J, £, x) using the MV algorithm 
3: /<_ t^;e <- |min{l,/} 
4: d «— |; d x oo 
5: repeat 

6: d^2d 

7: £' «— Lattice-Sparsifier(if , £, |d) 
8: for all y G Lattice-Enum((l + §)dif + x, £', re ) do 
9: d x <- mm{d x ,D K , £o (y - x), (1 + §)d + e } 
10: until d x < oo 

11: return Lattice-Enum((d E + eo)-^ + x, £', re ) 



x, £', reo), outputs a lattice vector in £' at distance at most (1 + |)d/ + eo from x. Since £' C £, we clearly 
have that d x < (1 + |)d/ + eo as needed. 

If the while loop terminates after the first iteration, then df = I < d x and hence ^d/ < d x as needed. If 
the loop iterates more than once, then for the sake of contradiction, assume that ^df > d x . Then in the last 
iteration, the value of d is greater than d x . Now we are guaranteed that Lattice-Sparsifier(if, £, |d) returns 
a lattice £' satisfying 

d K {C',y) < d K (£, x ) + £ -d < (1 + |)d 

But then the call to Lattice-Enum((l + §)div" + x, £', reo) is guaranteed to return a lattice point, and hence 
the while loop terminates at this iteration, a clear contradiction. Hence ^df < d x as needed. 

Let d' x = dK{£', x), for £' at the end of the while loop. We now claim that d x (as in the algorithm) 
satisfies d' x — Eq < d x < d' x + Eq. We first note that d x = min{d/ + Eq, Dk, £0 {z — x)} from some z G £'. 
By the guarantees on Dk,-, we get that 

d x = min{d/ + e ,D k ^ (z - x)} > min{d^,, ||z - x.\\ K - e } > d' x - e , 

as needed. For the second inequality, we examine two cases. First assume that Lattice-Enum(djiv" + 
x, £', reo) outputs z G C\P(K, £', x). Then d x < -D^ )£0 (z— x) < d' x +Eo as needed. If Lattice-Enum does 
not output any element of CVP(K, £, x), we must have that df < d' x and hence d x < df + Eq < d' x + £q, 
as needed. Finally by the construction of £', we also have that d' x < d x + e/3d/ < (1 + 2e/3)d x . 

Since d' x < d x + Eq, we know that {{d x + Eq)K + x) n £ ^ 0. Therefore we are guaranteed that the 
final call to Lattice-Enum((d x + Eq)K + x, £', reo) outputs all the closest vectors of £' to x. Finally, any 
vector y outputted during this call satisfies 

||y - x||k- < d x + 2e <d' x + 3e < (1 + 2 £ /3)d x + (e/3)Z < (1 + e)d x 

as needed. 
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Running Time: We first bound the running time of each call to Lattice-Enum. Within the while loop, the 
calls to Lattice-Enum((l+e/3)dK+x, re ) run in 2°^G((l+e/3)dK, £) poly(-) time and 2 n poly(-) 
space. By Lemma [27TI since (1 + e/3) = t(e/3) for t = (3/e + 1), we have that 

G((l + e/3)dK, C) < (At + 2) n G((e/3)d, £') = 6 n (l + 2/e) n G((e/3)d, C) = 2°^h~ n (l + l/e) n 

since by the guarantees on Lattice-Sparsifier, we have that G((e/3)d, £') = ^ n 2 ot - n \ Next the final call 
to Lattice-Enum((<i ! ; + Eq)K + x, re ) nans 2 0(n )G , ((d E + Eo)-K, £>') poly(-) time and 2 n poly(-) space. 
Now note that eq < \zd x , and hence (f + e/3)df > d x — so > (1 — e/9)d x . From here we get that 

d f > 1 ~ £/9 d x > 1 ~ 1/9 d x = 2/3d x 
1 ~ 1 + e/3 1 + 1/3 

Finally, 4+^0 < (1 + e/3)d/ + 2e < (1 + e/3)d f + 2/9ed x < (1 + 2e/3)d f . Therefore, since 
(1 + 2e/3) = t(e/3) for t = (2 + 3/e), we get that 

G({d x +e )d f K,£') < G((l + 2e/3)d f K, £') < (At + 2) n G((e/3)d f , C) 

= (10 + 12/e) n G((e/3)d f ,C) = 2°^j- n {l + l/e) n 

by the guarantee on £ . 

Lastly, note that each call to Lattice-Sparsifier takes at most 2°^ poly(-) time and 2 n poly(-) space. 
Since the while loop iterates polynomially many times (i.e. at most log 2 (2i?/r)),the total runtime is 2°^ > ^~ n (l+ 
l/e) n poly(-) and the total space usage is 2 n poly(-) as needed. □ 

4 A Simple Randomized Lattice Sparsifier Construction 

We begin with an existence proof for lattice sparsifiers using the probabilistic method. We will use the 
Cauchy-Davenport sumset inequality and another lemma in number theory about primegaps, a consequence 
of a theorem of Rosser and Schoenfeld [RS62l lNar00 lFI 

Theorem 4.1. Let p > 1 be a prime. Then for Ai, . . . , Aj. C Z p , we have that 

k 

\A X + --- + A k \ > mm{p,^2\Ai\ - k + 1} 

i=l 

Lemma 4.2. For x > 1000 there exists a prime p € Z satisfying x < p < 4p 

Proof of Lemma \4~2\ ( Prime Gap ). We will use the bounds ir(x) > x/ln(x) if x > 17, and ir(x) < 
1.25506a;/ In (a;) if x > 1 where n(x) denotes the number of primes < x BRS621 iNarOOl . If x > 1000 
then7r(4x/3) > (4x/3)/ ln(4x/3) > 1.25506x/ ln(x) > n(x), the lemma follows. □ 

We begin with the following crucial lemma. This forms the core of our lattice sparsifier construction. 

Lemma 4.3. Let p be a prime and S CZ* satisfying 1000 < \S\ < p < 4^ and G S. Then there exists 
a G Z" satisfying 

1- |{y e S : (y,a) = (mod p)}\ < 6 
2. |{(y,a) ( mo dp):ye5}|>£^ 

Proof. Let a denote a uniform random vector in Z™. We will show that a satisfies both conditions (1) and 
(2) with non-zero probability. Let Ef denote the indicator of the event (a, y) = % for y € S and i £ Z p . 



4 The authors are indebted to Janos Pintz for finding these references. 
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Claim 1: EE y6 5\{o}^]=^ 

Proof. By linearity of expectation it suffices to prove E[f?o] = Pr[(a, y)] = - for y € 5\{0}. Since y ^ 0, 
p is a prime, and a is uniform in Z™ we have that (a, y) is uniform in Z p . Therefore Pr[(a, y)] = |. □ 

Claim 2: E[^ yeS ^ y E^] = 

Proof. If x ^ y then E E*~ y = |. The Claim follows by the linearity of expectation. □ 

Now we will choose the vector a G Z". By Markov's inequality 

Pr[|{y G S \ {0} : (a, y) = 0}| < 6] > 1 - > |, and 

Pr[|{(x,y) :x,y 6 S,x/y, (a,x) = <a,y}}| <%>1- 5 -%^ > ± 
Hence there exists an a such that both events hold. The first condition of the lemma is easy to check: 
|{y € S : (y,a) = 0}| = |{y G S \ {0} : (y, a) = 0}| + 1 < 5 + 1 = 6. 

Now we will prove the second condition using our assumption and the Cauchy-Schwartz inequality: 

^ > |{(x, y) : x, y G S, x + y, (a, x) = (a, y}}| + \S\ = |{(x, y) : x, y G S, (a, x) = (a, y}}| 
= E ze zJ{y ^5: (a,y) ^z}| 2 > |S| 2 /|{(y,a) (mod p) : y G S}\. These yield 

|{(y,a) (modp):yGS}|>4f >^>2±2. □ 

We give now our first lattice sparsifier construction. While this theorem is stated for symmetric norms 
only, it can be easily extended to general norms (see Lemma l5^2l ). 

Theorem 4.4. Let K C W 1 be a symmetric convex body, C C W 1 an n-dimensional lattice, and t > Oa non- 
negative number. Let N = \tK n C\, and take a prime p satisfying N < p < ^j- if N > 1000 and p = 3 
otherwise. Then there exists w G C* such that the sublattice £( w ) = {y £ ^ : ( w jy) = (mod p)} 
satisfies 

1. Vx G R n , dif(£(w),x) < d K (C{vr),x) + 3t 

2. G(3tK,£(w)) < 1000 • 7 n 

Proof. If N < 1000, let w = 0, so £(0) = C. Condition (2) is trivially satisfied, and for condition (1) 
Lemma 12.11 implies 

G{3tK,C) < (2-3 + l) n \tKnC\ < 1000 • T. 

Now we assume that N > 1000. By Lemma l42l there exists a prime p satisfying N < p < ^j-, as re- 
quired by the theorem. Let B* = (b 1 , . . . , b n ) denote a basis for C*. Set S = {B* T y (mod pZ n ) : y G tK n C}. 

Claim: \CC\tK\ = \S\. 

Proof. Clearly \S\ < \C fl tK\. We will prove \S\ > \C n by contradiction: assume not and take 
yi> Y2 S £ n tK, where yi — y2 G p£. Set y = yi — y2, so y G 2tK. Note that (k/p)y G £ for A; G Z and 

||(fe/p)yk = IVp|l|yk<2tlVp| 

by the symmetry of JC. Hence for |A;| < [p/2\ we get ||(fc/p)y||ir < = t, i.e. (k/p)y G tiv". But then 
there are at least 2[p/2\ + 1 > p > N distinct lattice points in £ n tK, a contradiction. □ 
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Since G 5, and \S\ < p < ^p, by Lernma|43]there exists a G Z™ s.t. |y G 5 : (a, y) = (mod p) | < 
6 and |(a, y) (mod p) : y G S\ > 2±2. Let a denote the unique representative of a in {0, ... ,p — 1}™, 
and let w = B*a. 

Let Si n = {y G S : (a, y) = (mod p)} and C = {(a, y) (mod p) : y G 5}. We know that \S in \ < 
6 and |C| > by our guarantees on a. We establish condition (2) first. We know that \tK n £(w)| = 
I'S'ml < 6. Lemma |2~T1 implies 

G(3tir,£(w)) < 7 n • |tifn£(w)| < 7 n -6 < 1000-7™ 

Now we establish condition (1), i.e. for any x G W l , cZk-(£(w),x) < (Ik{£, x) + 3i. Let y G £ be (one 
of) the closest vector(s) to x, i.e. cIk(C, x) = ||y — x\\k- Since C C Z p , |C| > ^jr^ Theorem |4~T1 yields 

|C + C + C\ > min{p, 3(^±^ + 1) - 3} > p, 

and hence C + C + C = 7L V . Therefore, there exists yi,y2,y3 G tK n C and z G £(w) satisfying 
y = z + yi + y2 + y3- Finally, by the triangle inequality and the symmetry of K we get that 

||z - x||# < ||y - x||k + ||z - y||x < dic(Ax) + Si=i II _ yill-tf - rf A'(£,x) + 3i, as needed. □ 

5 Derandomizing the Lattice Sparsifier Construction 

We begin with a high level outline of the deterministic sparsifier construction. To recap, in the previous 
section, we build a (K, t) sparsifier for L as follows 

1. Compute N ^— \tK fl C\. If N < 1000 then return £' = C Else find a prime p satisfying N < p < 

4N 
3 ■ 

2. Build basis B* G Q nxn for C* and compute S <- {B* T y (mod p) : y G t K n £}. 

3. Find a vector a G Z™ satisfying (in fact, for slightly worse parameters, a random a G Z™ succeeds 
with constant probability) 

(a) |{yGS:(a,y)E0 (modp)}|<6 (6) |{<a, y) : y G S}\ > ^ 

4. Return sublattice C! = {y G C : (y, 5*a) = (mod p)}. 

To implement the above construction efficiently and deterministically, we must overcome several obsta- 
cles. First, the number of lattice points N in tK n C could be very large (since we have no control on t). 
Hence we can not hope to compute ./V or the set S efficiently via lattice point enumeration. Second, the con- 
struction of the vector a is probabilistic (see Lemma l43T i: we must replace this with an explicit deterministic 
construction. 

To overcome the first difficulty, we will build the (K, t) sparsifier iteratively. In particular, we will 
compute a sequence of sparsifiers £[,..., C' k , satisfying that C' i+1 is a (K, c l X) sparsifier for Cl i for i > 0, 
where £' = C, A = \i(K, C) and c > 1 is a constant. We start the sparsification process at the minimum 
distance of C. We only increase the sparsification distance by a constant factor at each step. Hence we will 
be able to guarantee that the number of lattice points we process at each step is 2°( n \ Furthermore, the 
geometric growth rate in the sparsification distance will allow us to conclude that C! i is in fact a (K, f^A) 
sparsifier for L. Hence, iterating the process roughly k « In ^- times will yield the final desired sparsifier. 

For the second difficulty, i.e. the deterministic construction of a, the main idea is to use a dimension 
reduction procedure which allows a to be computed efficiently via exhaustive enumeration (i.e. trying all 
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possible a's). Let N and S be as in the description. Since N < p < we note that an exhaustive search 
over Zp requires a search over p n < (^j-) n possibilities, and the validity check (i.e. conditions (a) and (&)) 
for any particular a can be implemented in poly(iV) time by simple counting. Since the existence of the 
desired a depends only on |5| and p (and not on n), if we can compute a linear projection ir : Z" — > Z™ -1 
such that vr(5) = 151, then we can reduce the problem to finding a good a £ Z™ -1 for ir(S). Indeed, such 
a map it can be computed efficiently and deterministically as long as n > 3. To see this, we first identify 
full rank n — 1 dimensional projections with their kernels, i.e. lines in Z™. From here, we note that distinct 
elements xjeS collide under the projection induced by a line I iff x — y £ I. Since the total number of 
lines spanned by differences of elements in S is at most ('g') < (2). as long as there are at least (^) lines in 
Z™ (i.e. for n > 3) we can compute the desired projection. Therefore, repeating the process n — 2 times, we 
are left with finding a good a £ Zp\ which we can do by trying all p + 1 < ^j- + 1 lines in Zp\ As discussed 
in the previous paragraph, we will be able to guarantee that N = 2 oi - n \ and hence the entire construction 
described above can be implemented in 2°( n ) time and space as desired. 

5.1 Algorithms 

We begin with the deterministic algorithm implementing Lemma 14.31 We denote the set of lines in Z™ by 
Lines(Z™). For a vector q £ Z" we denote its orthogonal complement by q- 1 = {y £ Z™ : (q, y) = (mod p)}. 

Algorithm 2 Algorithm Good- Vector^, p) 

1 1 S I 

Input: S C Z™, £ S, integer n > 1, p a prime satisfying 1000 < \S\ < p < 4^. 
Output: a £ Z™ satisfying conditions of Lemma 14.31 . 

1: if n = 1, return 1 

2: P ^— I n (n x n identity) 

3: for n in n to 3 do 

4: for all q £ Lines (Z£°) do 

5: Compute basis B £ Z^ *" " 1 satisfying q- 1 = SZ™ " 1 

6: V distinct x, y £ PS check that B T x ^ 5 T y (mod pZ n °^ 1 ). 

If no collisions, set P <— B T P and exit loop; otherwise, continue. 
7: for all q £ Lines^) do 
8: Pick a £ q \ {0} 

9: Compute zeros <r- |{y £ PS 1 : (a, y) = (mod p)}\ 
10: Compute distinct <(— |{(a, y) (mod p) : y £ 
11: if zeros < 6 and distinct > then 
12: return P t a 



For the desired application of the algorithm given below, the set S above will in fact be represented 
implicitly. Here the main access methodology we will require from S is a way to iterate over its elements. 
In the context of (l+e)-CVP, the enumeration method over S will correspond to the Lattice-Enum algorithm. 
Here we state the guarantees of the algorithm abstractly in terms of the number of iterations required over 
S. 

Theorem 5.1. Algorithm \2\ is correct, and performs poly(n, \ogp)p i arithmetic operations and 0(np 3 ) 
iterations over the elements of S. Furthermore, the space usage ( not counting the space needed to iterate 
over S) is poly(n, logp). 



11 



Analysis of Good-Vector. 

Correctness: We must show that the outputted vector a satisfies the guarantees of Lemma 1431 

1. |{yeS:(a,y) = (mod p)}\ < 6 

2. |{(a,y) ( mo dp):yeS}|>^ 

If n = 1 then setting a 6 Z p to 1 (i.e. line 1) trivially satisfies (1) and (2). We assume n > 2. We 
prove the following invariant for the first loop (line 2): at the beginning of each iteration, P G Zp° xn and 
\PS\ = \S\. 

First let us assume that during the loop iteration, we find B G Zp° x ^ no ^ satisfying B T -x ^ B T y for 
all distinct x, y G PS (verified in line 5). This yields that the map x — > B T x. is injective when restricted 
to PS, and hence \B T PS\ = \S\. Next, since B G i^^ 1 ) and P G z^° xn , we have that P is set to 

B T P 6 lip 1 ^ xn for the next iteration, as needed. 

Now we show that a valid projection matrix B T is guaranteed to exist as long as no > 3. First, we 
claim that there exists q G Lines(Z™°), such that for all distinct x, y G PS, (q + x) n (q + y) = 0, 
i.e. all the lines passing through PS in the direction q are disjoint. A line q fails to satisfy (a) if and only 
if q = Z p (x — y) for distinct x,y £ PS. The number of lines that can be generated in this way from 
PS is at most (l p /l) = (If I) < Since |Lines(Z£°)| = > £^ for n > 3 we may pick 

q G Lines(Z£) that satisfies (a). Now let B 6 ^ox(n -l) denQte & basis satisfying q ± = £Z£o-i. We 
claim that \B T PS\ = \PS\. Assume not, then there exists distinct x, y G PS such that 

B T x = B T y o B t {-k - y) = (x - y) £ (SZ^- 1 )^ = q, 

which contradicts our assumption on q. Therefore, the algorithm is indeed guaranteed to find a valid projec- 
tion, as needed. 

After the first for loop, we have constructed P G Zp Xn satisfying \PS\ = \S\, where \S\ < p < 
By Lemma [4731 there exists a G l? v satisfying (1) and (2) for the set PS. Since (1) and (2) holds for any 
non-zero multiple of a, i.e. any vector defining the same line as a, we may restrict the search to elements of 
Lines(Zp). Therefore, by trying all p+ 1 elements of Lines(Zp) the algorithm is guaranteed to find a valid a 
for the PS. Noting that (a, Py) = (P T a, y), we get that P T a satisfies (1) and (2) for the set S, as needed. 

Runtime: For n = 1 the runtime is constant. We assume n > 2. Here the first for loop is executed n — 2 
times. For each loop iteration we run though q G Lines(Zp°) until we find one inducing a good projection 

matrix B. From the above analysis, we iterate through at most ('f') < p( - p ~^ elements q G Lines(Zp°) 
before finding a good projection matrix. For each q, we build a basis matrix B for q- 1 which can be done 
using poly(n,logp) arithmetic operations. Next, we check for collisions against each pair x, y G PS, 
which can be done using 0(\S\) = 0(p) iterations over S. Therefore, at each loop iteration we enumerate 
over S at most p 3 times while performing only polynomial time computations. Hence, the total number of 
operations (excluding the time needed to output the elements of S) is at most poly (re, log p)p 4 . 

For the last phase, we run through the elements in Lines(Zp), where |Lines(Zp)| = p + 1. The validity 
check for a G Lines(Zp) requires computing both the quantities (1) and (2). To compute |{y G S : (y, a) = (mod p)} 
we iterate once over the set S and count how many zero dot products there are. To compute | { (a, y ) : y G S}\, 
we first iterate over all residues in Z p . Next, for each residue i G Z p , if we find y G S satisfying (a, y) = i 
(mod p), we increment our counter by one, and otherwise continue. Hence for any specific a G l? p , we 



12 



iterate over the set S exactly p + 1 times, performing poly(ra, log p)p 2 operations. Hence, over the whole 
loop we perform 0(p 2 ) iterations over the set S, and perform poly(n, logp)p 3 operations. 

Therefore, over the whole algorithm we iterate over the set S at most np 3 times, and perform at most 
poly(ra, logp)p 4 operations. Furthermore, not counting the space needed to iterate over the set S, the space 
used by the algorithm is poly(n, log p). □ 

Before moving into the derandomized sparsifier construction, we show a simple equivalence between 
building a sparsifier for symmetric and asymmetric norms. 

Lemma 5.2. Let K be a ^-symmetric convex body, and let C be an n-dimensional lattice. Take £' C C, a 
full dimensional sublattice. Then for t > 0, we have that £ is a (K n —K, t) sparsifier =>■ C is a (K, t) 
sparsifier. 

Proof. Let C C C be a (K n —K, t) sparsifier. Since K n —K is 1-symmetric, by definition we have that 
G(t(K n -K),C') = 2° (n) . By Lemma|Aj]and 7-symmetry of K, we have that 

N(tK, t(K n —K) = N(K, K n -K) < — < = V2 ; < 3 n 7~ n 

Therefore 

G(tK, £') < G(t(K n -K),C')N(tK, t(K n -K)) = 2 0( -^3 n -f~ n = 2°^^ n as needed. 

Since K n -if C Jv", we note that ||a||i^ < ||a||^ n -/r for all a G W 1 . Now take x E M n , and take 
z G CVP(iC, £, x). By the guarantee on £', there exists y £ £' such that 

||y - z|kn-A- < d Kn ^ K (C, z) + t = t 

since ze£. Next, using the triangle inequality we have that 

||y - x||k < ||y - z|k + ll z - x lk < l|y - Ak^-k + d K (c,x) < d K (c,x) + 1 

as needed. Therefore, C is a (if, i) sparsifier for C as claimed. □ 

From the above lemma, we see that it suffices to build lattice sparsifiers for symmetric convex bodies, 
i.e. to build a (K, t) sparsifier it suffices to build a (K n —K, t) sparsifier for C. 

We now show how to use the Good- Vector algorithm to get a completely deterministic Lattice Sparsifier 
construction. The correctness and runtime of the algorithm given below yields the proof of Theorem 13 .21 

Proof of Theorem \3.2\ ( Lattice Sparsifier Construction). 

Correctness: We show that the outputted lattice is a (K, t) sparsifier for £. By Lemma 15^21 it suffices to 
show that the algorithm outputs a (K n —K, t) sparsifier, which justifies the switch in line 2 from K to 
K n —K. In what follows, we therefore assume that K is symmetric. 

We first claim that A < 2\\(K, C). To see by the guarantee on Shortest- Vector^ , C, |), we have that 
\\y\\K < §Ai(A',£). This implies 

A < ^||y|k < I • \\i(K,C) = 2Ai 

as needed. 
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Algorithm 3 Algorithm Lattice-Sparsifier(iY~, C, t) 

Input: (0, r, R) -centered convex body K C W 1 with distance oracle Dk,- for || • \\k, basis B £ Q nxn for 

£, and t > 0. 
Output: (K, t) sparsifier for C 
1: K^Kn-K 

2: Compute y G Shortest- Vectors (if, £, |) 
3: A^L> X) i(y);£^7-( n+5 ) 

4: fc<- Lln(fi + l)/ln3j 

5: Cq ^ C; B <^ B 

6: for i in to k — 1 do 

7: 5 -G- Lattice-Enum(3*(l - e)XK, £j,eAr) 

8: Compute TV <- |5| 

9: if A > 1000 then 

10: Compute B* G- B t ~ T , a basis for £* 

11: Compute prime p satisfying N < p < ^j- 

12: a G- Good-Vector^* 7 ^ (modpZ n ),p) 

13: Compute Ci + \ {y G : (5*a, y) = (mod p)} and basis for C- l+ i 

14: else 

15: A+l A; -Bi 

16: return £& 



Claim 1: for each i, < i < k, we have that 

1. Vx € M n , d K (Ci,x) < d K (C,x) + f (3 i - 1)A. 

2. G(3' ; A,£i) < 7 n+4 . 

Proof. We establish the claim by induction on i. For i = 0, we have that Co = C. Therefore, Co trivially 
satisfies property (1). Next, since A < 2X 1 (K, C), by LemmaOwe have that G(XK, C ) < (2 • 2 + 1)™ = 
5" < 7™ +4 . Hence C also satisfies (2). 

We now prove the claim for i > 1. Let 5 denote the set outputted by Lattice-Enum(3 t ~ 1 (1— e) XK, Ci-\, eXr). 
By the guarantees on Lattice-Enum, the set S satisfies 3 J_1 (1 - e)XK n £^_i CSC (3 l-1 (l - e)XK + 
eXrB%) n d-x. Since rB% C AT and i > 1 we have 3 i-1 (l - e)AA + eArSJ C W^XR. Therefore, 

3 <_1 (1 - e)XK n CSC 3 i_1 AA: n A_i (5.1) 

Set iV = \S\ (line 8). By (15.11 ) and the induction hypothesis we have 

(I - e)XK r\ d-i\ < N < ^XKHCi-il < G^XK^C) < 7 n+A 

Assume A < 1000. Then the algorithm sets Ci = Ci-\ and Bi = £?i_i. The induction hypothesis 
implies for x G W l that 

d K (d, X ) = djc(£-i,x) < d K (C,x) + j^" 1 - 1)A < d K (C,x) + ^(3* - 1)A, 
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and hence L\ satisfies (1). Next, by (15.11 ) we have that |3*(1 — e)XK DCi\ < N < 1000. Therefore, Lemma 
O yields 

G{3 i+1 XK, C i+1 ) < (2 • 3(1/(1 - e)) + l) n |3 l (l - e)\K n A+i| 

< 7 n (l + 2e) n ■ 1000 < 7 n+4 , 

where the last two inequalities follow since e < 7~( n+5 ). Therefore £j satisfies requirement (2) as needed. 
Assume N > 1000. Here we first compute N < p < 4 g-, and a dual basis B*_^ for £*_!■ 

Claim 2: \Bf£ x S (mod pZ n )| = N 

Proof. Since |5| = N, if the claim is false, there exists distinct x, y G £ such that 



BjTjX = B^y (mod pZ n ) <^ B^(x - y) = (mod pZ n ) 44> x - y G p£ 



i-l- 



Since x, y G 3 ?-1 Aif and i*T is symmetric, we have that x — y € 2 • 3 i ~ 1 K flj)£j_i. Let z = x — y G pA-i- 
We examine the vector for s£Z satisfying |s| < = ^i - (since p is odd). Since | G A-i» we nave 
that s| G and 



z 

s- G 



2 • 3 i-1 2ir C f ? ] 2 • 3^^ = [ 1 - - ) 3^^ 



2p J \ P 



C (1 - e)^ 1 ^, 



where the last inequality follows since p < < | • 7 n+4 and e = 7~( n+5 \ Then, since s can take 
2|_§J -+- 1 = p different values, the set (1 — e)3 l ~ l K contains at least p lattice points in £j_i. However, by 
the construction of N, we have that 

|(1 — e)3 l ~ l K n £i-\\ < N < p, a clear contradiction. The claim thus holds. □ 

Next, the algorithm computes a <(— Good-Vector(B* T S' (mod pZ, n ),p), and sets 
£i = {y ^ £ : {B*a, y) = (mod p)}. From Claim 2, equation |5 . 1 1 and the guarantees on Good- Vector, 
we get 

1. |3 i_1 (l - e)\K n d\ = |{y G 3 <_1 (1 - e)Aif n A-l = <-B*a, y) = (mod p)}| < 6. 

2. |{(B*a,y) (mod p) : y G V^XK D > 

From here, using the identical analysis as in Theorem 14 .4 1 from (a) above we get that Vx G W 1 , dx{£i, x) < 
dic(£i-i, x) + 3 • 3* _1 A. The induction hypothesis on implies 

dic(A-i,x) + 3*A < d K (£,x) + ^{ST 1 - 1)A + 3* A = d K (£,x) + ^(3 l - 1)A. 
Therefore £i satisfies (1) as needed. Using (b) and Lemma |2~T1 we have that 

G{3 i \K,£ i ) < (2-3- (1/(1 -e)) + l) n |3^ 1 (l-e)A^n£ i | 
< 7"(1 + 2e) n • 6 < 7 n+4 . 

Therefore £i satisfies (2). The claim thus follows. □ 
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Given Claim 1, we will show that Ck is a (K, t) sparsifier for C. By our choice of k, note that |(3 fc — 
1)A <t < 3-§(3 fc+1 -l)A. By the claim, for x € M n , d K (C k , x) < ^(£,x) + |(3 fc -l)A < d K (£,x) + t. 
It therefore only remains to bound G(tK, Cp.)- By the previous bounds 

t ^ 3 (3 fc+1 - 1)A 9 
Wx ~ 2 3^ < 2 

Therefore, the claim and Lemma |2~T1 imply 

G(tK, £ fc ) < (2 • | + l) n G(3 fc AK, £ fe ) < 10™ • 7 n+4 = 2° (n) 
as needed. The algorithm returns a valid (K, t) sparsifier for C. 

Runtime: The algorithm first runs the Shortest- Vectors on K and C, which takes 2°( n ) poly(-) time and 
2 n poly(-) space. Next, the for loop on line 6 iterates k = L m (|^ + 1) / In 3j = poly(-) times. 

Each for loop iteration, indexed by i satisfying < i < k — 1, consists of computations over the set 
S Lattice-Enum(3*(l — e)XK, Ci,e\r). For the intended implementation, we do not store the set S 
explicitly. Every time the algorithm needs to iterate over S, we implement this by performing a call to 
Lattice-Enum(3 J (l — e)XK, d,eXr). Furthermore, the algorithm only interacts with S by iterating over its 
elements, and hence the implemented interface suffices. Now at the loop iteration indexed by i, we do as 
follows: 

1. Compute N = \S\. This is implemented by iterating over the elements of S and counting, and so by 
the guarantees of Lattice-Enum requires at most 2 ^G(3 l XK, Ci) poly(-) = 2°^ poly(-) time (by 
Claim 1) and 2 n poly(-) space. 

2. If N < 1000, we keep the same lattice and skip to the next loop iteration. If N > 1000, continue. 

3. Compute B* = B~ T . This can be done in poly(-) time and space. 

4. Compute a prime p satisfying N < p < Such a prime can be computed by trying all integers in 
the previous range and using trial division. This takes at most 0(N 2 poly(log N)) = 2°^ time and 
poly(n) space. 

5. Call Good- Vector (B T *S (mod pZ n ),p). By the guarantees on Good- Vector, the algorithm performs 
poly(n, logp)p 4 = 2°( n ) operations and iterates at most np 3 = 2°( n ) times over the set B T *S 
(mod pZ n ). These iterations can be performed 2°^ poly(-) time and 2 n poly(-) space by the guar- 
antees on Lattice-Enum. 

6. Compute a basis B i+ i for the new lattice Ci + \ = {y G £j : (S* T a, y) = (mod p)}. This can be 
done in poly(-) time. 

From the above analysis, we see that the entire algorithm runs in 2°( n > poly(-) time and 2 n poly(-) space 
as needed. □ 
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6 Further Applications and Future Directions 



Integer Programming. We explain how the techniques in this paper apply to Integer Programming (IP), 
i.e. the problem of deciding whether a polytope contains an integer point, and discuss some potential as- 
sociated venues for improving the complexity of IP. For a brief history, the first breakthrough works on IP 
are by Lenstra HLen831 and Kannan Kan87L where it was shown that any n- variable IP can be solved in 
2°( n ) n 2 - 5n time (with polynomial dependencies on the remaining parameters). Since then, progress on IP 
has been slow, though recent complexity improvements have been made: the dependence on n was reduced 
to n 2n HHK10L 0(n)t n HDPV11L and finally n n HDadl2al . 

Let K C W 1 denote a polytope. To find an integer point inside K, the general outline of the above 
algorithms is as follows. Pick a center point c € K, and attempt to "round" c to a point in Z n inside K. If this 
fails, decompose the integer program on K into subproblems. Here, the decomposition is generally achieved 
by partitioning Z n along shifts of some rational linear subspace H (often a hyperplane) and recursing on the 
integral shifts of H intersecting K. 

In MDadl2bll . an algorithm is given to perform the above rounding step in a "near optimal" manner. 
More precisely, the center c of K is chosen to be the center of gravity b of K (which can be estimated 
via random sampling), and rounding b to Z n is done via an approximate CVP computation with target 
b, lattice Z n , and norm || • \\k-\> (corresponding to scaling K about b(A')). Here the AKS randomized 
sieve is used to perform the approximate CVP computation, which is efficient due to the fact that K — b 
is near-symmetric (see [MP00|). Let y € U 1 be the returned (1 + e)-CVP solution, and assume that y 
is correctly computed (which occurs with high probability). We can now examine the following cases. If 
y 6 K, we have solved the IP. If ||y — b||^_b > (1 + e). then by the guarantee on y, for any z 6 P we 
have that ||z — b||^_b > 1 z ^ K. Hence, we can immediately decide that K n Z n = 0. Lastly, if 
1 < l|y ~~ b||^_b < (1 + we know that j^K + jq^b is integer free while (1 + e)K — eh contains y. In 
this final case, we are in essentially a near-optimal situation for computing a "good" decomposition (using 
the so-called "flatness" theorems in the geometry of numbers). We note with previous methods (i.e. using 
only symmetric norm or £2 techniques), the ratio of scalings between the integer free and non integer free 
case was 0(n) in the worst case as opposed to (1 + e) 2 (here e can be any constant < 1). 

With the techniques in this paper, we note that the above rounding procedure can be made Las Vegas 
(i.e. no probability of error, randomized running time) by replacing the AKS Sieve with our new DPV based 
solver (randomness is still needed to estimate the center of gravity). This removes any probability of error 
in the above inferences, making the above rounding algorithm easier to apply in the IP setting. We note that 
the geometry induced by the above rounding procedure is currently poorly understood, and very little of it 
is being exploited by IP algorithms. One hope for improving the complexity of IP with the above methods, 
is that with a strong rounding procedure as above one maybe able to avoid the worst case bounds on the 
number of subproblems created at every recursion node. Currently, the main way to show that K admits a 
small decomposition into subproblems is to show that the covering radius of K (i.e. the minimum scaling 
such that every shift of K intersects Z n ) is large. Using the above techniques, we easily get that in the final 
case the covering radius is > (since K+ yr^b is integer free), however in reality the covering radius 
could be much larger (yielding smaller decompositions). Here, an interesting direction would be to try and 
show that on the aggregate (over all subproblems), the covering radii of the nodes must grow as we go down 
the recursion tree. This would allow us to show that as we descend the recursion tree, the branching factor 
shrinks quickly, allowing us to get better bounds on the size of the recursion tree (which yields the dominant 
complexity term for current IP algorithms). 
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CVP under i^. While the ideas presented here do not seem to be practically implementable in general 
(at least currently), there are special cases where the overhead incurred by our approach maybe acceptable. 
One potential target is solving (1 + e)-CVP under t^. This is one of the most useful norms that is often 
approximated by I2 for lack of a better alternative. 

As an example, in BBC07B . they reduce the problem of computing machine efficient polynomial approx- 
imations (i.e. having small coefficient sizes) of 1 dimensional functions to CVP under t^. The goal in this 
setting is to generate a high quality approximation that is suitable for hardware implementation or for use in 
a software library, and hence spending considerable computational resources to generate it is justified. 

We now explain why the norm version of our algorithms maybe suitable for practical implementation 
(or at least efficient "heuristic" implementation). Most importantly, for the DPV lattice point enumerator 
is trivial to implement. In particular, to enumerate the lattice points in a cube, one simply enumerates the 
points in the outer containing ball and retains those in the cube. Second, if one is comfortable with random- 
ization, the sparsifier can be constructed by adding a simple random modular form to the base lattice. For 
provable guarantees, the main issue is that the modulus must be carefully chosen (see Section©, however it 
seems plausible that in practice an appropriate modulus may be guessed heuristically. 
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A Covering Bound 

In this section, we prove the basic covering bound stated in Lemma |2~T1 

For a set A C M. n , let int(A) denote the interior of A. For convex bodies A, B C R n , we define the 
covering number N(A, B) = inf{|A| : A C M n , A C A + B}, i.e. the minimum number of translates of B 
needed to cover A. We will require the following standard inequality on the covering number. 

Lemma A.l. Let A,B C M n be convex bodies, where B is symmetric. Then 

vo\ n {A + B/2) 



N(A, B) < 



vol n (5/2) 



Proof. Let TCibe any maximal set of points such that for all distinct x, y G T, (x+l?/2) n (y + B/2) = 
0. We claim that A (1 T + B. For any z G A, note by maximality of T that there exists x G T such that 
(z + B/2) n (x + B/2) ^ 0. Therefore z € x + B/2 - B/2 = x + B, as needed. 
Since T + 5/2 corresponds to \T\ disjoint translates of B/2, we have that 

|T| vol n (B/2) = vol n (T + B/2) < vol n (A + B/2). 

Rearranging the above inequality yields the lemma. □ 

Proof of Lemma \2A\ We prove the bound on G(dK, C) in terms of Ai (A n — AT, £). 
Let s = t;\i(K n — A, £). For x G £, we examine 

x + int(s(A n -A)) ={z£l": ||z - x\\ K n-K < s}. 

Now for x,y£/!,x/y, we claim that 

x + int(s(A n —A)) n y + int(s(A n —A)) = (A.l) 

Assume not, then 3 z G M n such that ||z — x||ifn-A", ||z — y\\Kn~K < s. Since A n —A is symmetric, we 
note that ||y — z\\kci-k = ||z — y ||A'n-A" < s. But then we have that 

||y - ^Wxn-K = ||y - z + z - x||xn-K < ||y - Akh-k + ||z - x||ifn-if 
< s + s = 2s = Ai(A n — A, £), 

a clear contradiction since y - x / 0. 

Take c € W l . To bound G(dK, C) we must bound |(c + dK) n £|. For x G c + c?A, we note that 
x + s(K n -A) C c + (d + s)K. Therefore, 

vol n ((d + s)K) = vol n (c + (d + s)K) > vol n (((c + dK) n C) + s(K n —A)) 
= |(c + dA) n £| vol n (s(A n —A)) 

where the last equality follows from (jAip . Therefore, we have that 

kc + d K) n c\ < v ° u !t + 5) ^» = ( d -±A° - 7 - fl + M 



vol n (s(A n -A)) V 7 s 7 V Ai(A n — A, £) 
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as needed. 

We prove the bound on G(dK, C) in terms of |(if n —if) n C\. Examine dK + x. Let yi, . . . , yjv £ 
(tK + x) n C, denote a maximal collection of points such that the translates y, + \ {K n —if), i <G [N], are 
interior disjoint. We claim that (dK + x) n C C U^y* + (if n -if). Take z € (dif + x) n £. Then by 
construction of yi, . . . , yjv, there exists i € [N] such that 

z + i(if n -if) n y, + X -(K n -if ) / z e yi + (if n -if) 

as needed. Therefore \(dK + x) n £| < £™ =1 |(y< + (-K" n -if)) n £| = N\(K n -if) D £|. Since if is 
7-symmetric, we get that 

= vol TO (ur =1 y, + |(ifn-if)) voln(dif+^(ifn-if)) 

vol n (i(if n-if)) " vol n (if) ~ J { ' 

as needed. Since the above bound holds for all x € W 1 , we get that 

G(tK, £) < 7~ n (2d + l) n • | (if n -if) n £| as needed. □ 
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